 (defn- system-permissions-granted-by-acls
   "Returns a set of permission keywords granted on the system target to the given sids by the given acls."
   [system-object-target sids acls]
-  (collect-permissions (fn [acl permission]
-                         (and (= system-object-target (:target (:system-object-identity acl)))
-                              (acl/acl-matches-sids-and-permission? sids (name permission) acl)))
-                       acls))
+  (let [relevant-acls (filter #(-> % :system-object-identity :target (= system-object-target))
+                              acls)]
+    (set
+      (for [permission [:create :read :update :delete]
+            :when (some #(acl/acl-matches-sids-and-permission? sids (name permission) %)
+                        relevant-acls)]
+        permission))))
 
 (defn get-system-permissions
   "Returns a map of the system object type to the set of permissions granted to the given username or user type."

    (cpv/validate-parameters
      :acl safe-params
      (concat cpv/common-validations
              [permitted-group-validation identity-type-validation group-permission-validation])
      type-errors))
  params)


   :provider :string
   :permitted-user :acl-permitted-user
   :group-permission :acl-group-permission})

(defmethod cp/parse-query-level-params :acl
  [concept-type params]
  (let [[params query-attribs] (cp/default-parse-query-level-params :acl params)
        result-features (when (= (:include-full-acl params) "true"
                                 [:include-full-acl]))]
    [(dissoc params :include-full-acl)
     (merge query-attribs
            (when (= (:include-full-acl params) "true")
              {:result-features [:include-full-acl]}))]))

(defmethod cp/parameter->condition :acl-identity-type
 [context concept-type param value options]
